Secure instant messaging system

1. A process for the secure transmission and reception of data files and text messages via an instant messaging system across a computer network, comprising the steps of:

providing a first instant messaging client associated with a first user, said first user having an associated screen name;

sending a certificate to an instant messaging server that associates said first user's screen name with a public key value along with said first user's status for said certificate;

publishing said certificate and said status to users associated to the first user through at least one list of preferred users; and

displaying instant messages received and their security status.

2. The process of claim 1 , wherein said at least one list of preferred users comprises any of:

the first user's list of preferred users and the at least one of the lists of other users that have the first user on their list of preferred users.

3. The process of claim 1 , further comprising the steps of:

providing a subscriber database, wherein said subscriber database includes, but is not limited to:

user screen names, user subscription expiration dates, and enrollment agent information for users; and

issuing said certificate by a certificate authority.

4. The process of claim 1 , further comprising the step of:

providing a second instant messaging client, wherein said second instant messaging client is associated with a second user; and wherein the second user has an associated screen name.

5. The process of claim 4 , further comprising the steps of:

calculating a hash value for the first user's certificate by the server and sending said hash value to said at least one of said users associated to the first user through at least one list of preferred users, wherein said second instant messaging client receives said hash value;

comparing said hash value with a hash value for the first user's certificate by said second instant messaging client stored in a cache on said second instant messaging client;

if said hash comparison means finds that said hash value does not match said cached hash value or said cached hash value does not exist, requesting the first user's certificate from said instant messaging server by said second instant messaging client;

sending the first user's certificate and said hash value in response to said second instant messaging client's request; and

storing the first user's certificate and said hash value in said cache by said second instant messaging client.

6. The process of claim 4 , further comprising the steps of:

encrypting an instant text message to the first user by said second instant messaging client using the first user's certificate;

sending said encrypted instant text message to said instant messaging server;

forwarding said encrypted instant text message to said first instant messaging client by said instant messaging server if the first user is logged on; and

receiving said encrypted instant text message from said instant messaging server and decrypting said encrypted instant text message using the first user's certificate.

7. The process of claim 6 , further comprising any of the steps of:

reusing an encryption key value by said first instant messaging client obtained from decrypting said encrypted instant text message in subsequent messages during an instant message conversation with said second instant messaging client;

attaching an encryption algorithm to said encrypted instant text message by said second instant messaging client that was used to encrypt said encrypted instant text message, wherein said first instant messaging client uses said encryption algorithm to decrypt said encrypted instant text message;

wrapping said encrypted instant text message by said second instant messaging client using a wrapping algorithm and wrapping key, wherein said second instant messaging client attaches said wrapping algorithm and said wrapping key to said encrypted instant text message, and wherein said first instant messaging client extracts said wrapping key from said encrypted instant text message and uses said wrapping algorithm and said wrapping key to unwrap said encrypted instant text message.

8. The process of claim 7 , further comprising any of the steps of:

receiving said encrypted file by said first instant messaging client from said instant messaging server and decrypting said encrypted file using the first user's certificate; and

if a file transfer to said first instant messaging client has been terminated before an encrypted file has been fully transferred, requesting by said first instant messaging client any remaining portions of an encrypted file from said second instant messaging client, wherein said second instant messaging client sends remaining portions of said encrypted file to said instant messaging server, and wherein said instant messaging server forwards said encrypted file portions to said first instant messaging client.

9. The process of claim 4 , further comprising the steps of: signing an instant text message to the second user using the first user's certificate;

sending said signed instant text message to said instant messaging server, and wherein said instant messaging server forwards said signed instant text message to said second instant messaging client if the first user is logged on;

receiving said signed instant text message by said second instant messaging client from said instant messaging server and verifying said signed instant text message using the first user's certificate; and

reusing a signature value by said first instant messaging client in subsequent messages during an instant message conversation with said second instant messaging client.

10. The process of claim 7 , further comprising the step of:

escrowing a set of encryption keys; wherein instant messaging clients belonging to a company encrypt instant messages to the escrowed keys to enable recovery; and wherein said escrowed encryption keys allows said company's officials to recover the contents of messages when required; and

providing an audit log proxy, wherein said audit log proxy records messages sent in and out of said company; and

enforcing an audit/escrow policy by blocking messages that are not encrypted using an escrowed key.

11. An apparatus for the secure transmission and reception of data files and text messages via an instant messaging system across a computer network, comprising:

a first instant messaging client associated with a first user, said first user having an associated screen name, said first instant messaging client comprising means for sending a certificate to said instant messaging server that associates said first user's screen name with a public key value along with said first user's status for said certificate;

an instant messaging server comprising means for publishing said certificate and said status to users associated to the first user through at least one list of preferred users; and

means for displaying instant messages received and their security status.

12. The apparatus of claim 11 , wherein said at least one list of preferred users comprises any of:

the first user's list of preferred users;

and the lists of other users that have the first user on their list of preferred users.

13. The apparatus of claim 11 , further comprising:

a certificate authority, wherein said certificate authority issues said certificate; and

a subscriber database, wherein said subscriber database includes, but is not limited to:

user screen name, user subscription expiration dates and enrollment agent information for users.

14. The process of claim 11 , further comprising:

a second instant messaging client, wherein said second instant messaging client is associated with a second user; and wherein the second user has an associated screen name.

15. The apparatus of claim 14 , further comprising:

means for calculating a hash value for the first user's certificate by the server and sending said hash value to said at least one of said users associated to the first user through at least one list of preferred users, wherein said second instant messaging client receives said hash value;

means for comparing said hash value with a hash value for the first user's certificate by said second instant messaging client stored in a cache on said second instant messaging client;

means for, if said hash comparison means finds that said hash value does not match said cached hash value or said cached hash value does not exist, requesting the first user's certificate from said instant messaging server by said second instant messaging client;

means for sending the first user's certificate and said hash value in response to said second instant messaging client's request; and

means for storing the first user's certificate and said hash value in said cache by said second instant messaging client.

16. The apparatus of claim 14 , further comprising:

means for encrypting an instant text message to the first user by said second instant messaging client using the first user's certificate;

means for sending said encrypted instant text message to said instant messaging server;

means for forwarding said encrypted instant text message to said first instant messaging client by said instant messaging server if the first user is logged on; and

means for receiving said encrypted instant text message from said instant messaging server and decrypting said encrypted instant text message using the first user's certificate.

17. The apparatus of claim 16 , further comprising:

means for reusing an encryption key value by said first instant messaging client obtained from decrypting said encrypted instant text message in subsequent messages during an instant message conversation with said second instant messaging client;

means for attaching an encryption algorithm to said encrypted instant text message by said second instant messaging client that was used to encrypt said encrypted instant text message, wherein said first instant messaging client uses said encryption algorithm to decrypt said encrypted instant text message; and

means for wrapping said encrypted instant text message by said second instant messaging client using a wrapping algorithm and wrapping key, wherein said second instant messaging client attaches said wrapping algorithm and said wrapping key to said encrypted instant text message, and wherein said first instant messaging client extracts said wrapping key from said encrypted instant text message and uses said wrapping algorithm and said wrapping key to unwrap said encrypted instant text message.

18. The apparatus of claim 17 , further comprising any of:

means for receiving said encrypted file by said first instant messaging client from said instant messaging server and decrypting said encrypted file using the first user's certificate; and

means for, if a file transfer to said first instant messaging client has been terminated before an encrypted file has been fully transferred, requesting by said first instant messaging client any remaining portions of an encrypted file from said second instant messaging client, wherein said second instant messaging client sends remaining portions of said encrypted file to said instant messaging server, and wherein said instant messaging server forwards said encrypted file portions to said first instant messaging client.

19. The apparatus of claim 14 , further comprising:

means for signing an instant text message to the second user using the first user's certificate;

means for sending said signed instant text message to said instant messaging server, wherein said instant messaging server forwards said signed instant text message to said second instant messaging client if the first user is logged on;

means for receiving said signed instant text message by said second instant messaging client from said instant messaging server and verifying said signed instant text message using the first user's certificate; and

means for reusing a signature value by said first instant messaging client in subsequent messages during an instant message conversation with said second instant messaging client.

20. The apparatus of claim 17 , further comprising:

means for escrowing a set of encryption keys; wherein instant messaging clients belonging to a company encrypt instant messages to the escrowed keys to enable recovery; and wherein said escrowed encryption keys allow said company's officials to recover the contents of messages when required; and

means for providing an audit log proxy, wherein said audit log proxy records messages sent in and out of said company; and

means for enforcing an audit/escrow policy by blocking messages that are not encrypted using an escrowed key.